Telerik UI For ASP.NET AJAX R2 2017 SP1 (version 2017.2.621)

the telerik.ui.radasyncupload's upload method now accepts a customfilename parameter that is a function returning a string. this string will be used as the file name for the uploaded file. the asyncuploadhandler will return this string to the client upon completion of the upload operation.

Telerik UI for ASP.NET AJAX R2 2017 SP1 (version 2017.2.621)

the telerik.ui.radasyncupload's oncomplete event now fires an oncomplete event in the form of a jquery hook event. for more information on jquery hooks, please refer to the api documentation for jquery's hook event.

the telerik.ui.radasyncupload's onprogress event now fires an onprogress event in the form of a jquery hook event. for more information on jquery hooks, please refer to the api documentation for jquery's hook event.

the telerik.ui.radasyncupload's onerror event now fires an onerror event in the form of a jquery hook event. for more information on jquery hooks, please refer to the api documentation for jquery's hook event.

telerik ui for asp.net ajax is a widely used suite of ui components for web applications. it insecurely deserializes json objects in a manner that results in arbitrary remote code execution on the software's underlying host. the managed security services (mss) team at bishop fox has identified and exploited internet-facing instances of telerik ui affected by this vulnerability for our clients. since telerik has just responded to this issue by releasing a security advisory for cve-2019-18935, we're sharing our knowledge about it here in an effort to raise awareness about the severity of this vulnerability, and to encourage affected users to patch and securely configure this software. patching instructions are included at the end of this post.

https://www.raasayana.com/group/raasayana-group/discussion/34fd47fa-a8e0-4f0e-b7fc-4b8415450090